Windows: Zone.Identifier Alternate Data Stream Deleted by Uncommon Application

Alert on deletion of the Zone.Identifier ADS by an uncommon process on Windows.

FreeReviewedSigma · Medium · v2

Product: windows
Category: file_delete
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-09-04
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1070.004File Deletion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies deletion of the "Zone.Identifier" alternate data stream on a file when the deleting process image is not in a defined set of common browsers and Windows/PowerShell executables. Removing the Zone.Identifier ADS can help attackers reduce the effectiveness of content-marking controls used by applications such as Office. It relies on Windows file deletion telemetry that includes the target filename/path ending with ":Zone.Identifier" and the initiating process image.

Reporting behind it

Related detections9 linkedT1070.004 — drag to rearrange

Suspicious Self-Delete Chain via Loopback Ping and File Deletion (via process_creation)

Suspicious Anti-Recovery Zeroing via fsutil setZeroData (via process_creation)

Suspicious Zone.Identifier Mark-of-the-Web Removal (via process_creation)

Suspicious Self-Deletion of Dropper via Command Line

Suspicious Self-Deletion via Choice Timer and Del Command via Cmd (via process_creation)

Suspicious Jump List AutomaticDestinations Deletion via Cmd (via process_creation)

Suspicious Self-Delete via cmd choice Timeout and Del

Suspicious Ping Loopback Delay Followed by File Deletion for Evasion

Suspicious Alternate Data Stream Self-Deletion via process_creation

Windows: Zone.Identifier Alternate Data Stream Deleted by Uncommon Application

Pivot detection · T1070.004 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-uncommon-process-deletes-zone-identifier-alternate-data-stream-ads-3109530e

title: "Windows: Zone.Identifier Alternate Data Stream Deleted by Uncommon Application"
id: 2f56e404-f457-4068-adfe-4530c4867a2e
related:
  - id: 7eac0a16-5832-4e81-865f-0268a6d19e4b
    type: similar
  - id: 3109530e-ab47-4cc6-a953-cac5ebcc93ae
    type: derived
status: test
description: This rule identifies deletion of the "Zone.Identifier" alternate data stream on a file when the deleting process image is not in a defined set of common browsers and Windows/PowerShell executables. Removing the Zone.Identifier ADS can help attackers reduce the effectiveness of content-marking controls used by applications such as Office. It relies on Windows file deletion telemetry that includes the target filename/path ending with ":Zone.Identifier" and the initiating process image.
references:
  - https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_zone_identifier_ads_uncommon.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-04
modified: 2025-07-04
tags:
  - attack.stealth
  - attack.t1070.004
logsource:
  product: windows
  category: file_delete
detection:
  selection:
    TargetFilename|endswith: :Zone.Identifier
  filter_main_generic:
    Image:
      - C:\Program Files\PowerShell\7-preview\pwsh.exe
      - C:\Program Files\PowerShell\7\pwsh.exe
      - C:\Windows\explorer.exe
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      - C:\Windows\SysWOW64\explorer.exe
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  filter_optional_browsers_chrome:
    Image:
      - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      - C:\Program Files\Google\Chrome\Application\chrome.exe
  filter_optional_browsers_firefox:
    Image:
      - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
      - C:\Program Files\Mozilla Firefox\firefox.exe
  filter_optional_browsers_msedge:
    Image:
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      - C:\Program Files\Microsoft\Edge\Application\msedge.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Other third party applications not listed.
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL